UNITED STATES DISTRICT COURT 
DISTRICT OF NEW JERSEY 


FILED 

DEC 0 3 2018 


UNITED STATES OF AMERICA 


V. 


OLEKSII IVANOV, 

a/k/a “Oleksii Petrovich Ivanov,” 
a/k/a “Alex Ivanov,” and 
a/k/a/“lBaHOB OAeKcin” 


AT 


/: c 


Hon. 

Criminal No. 18- ud(ksu) 


WILLIAM T. dUsH 

CLERK 


& 


18 U.S.C. § 1349 
18 U.S.C. § 1343 

18 U.S.C. §§ 1030(a)(5)(A), (c)(4)(B) 
18 U.S.C. § 2 


INDICTMENT 

The Grand Jury in and for the District of New Jersey, sitting at Newark, 
charges: 


COUNT ONE 

(Conspiracy to Commit Wire Fraud) 

1. At all times relevant to Count One of this Indictment: 

a. OLEKSII IVANOV, a/k/a “Oleksii Petrovich Ivanov,” a/k/a “Alex 
Ivanov,” and a/k/a “iBaHOB OAeKcin,” (hereinafter, “IVANOV”) was a citizen of 
Ukraine who last resided in Kiev, Ukraine. 

b. Company A was a company headquartered in New York, New 
York that operated an advertising server platform used by advertising server 
companies to place advertisements on online websites. Company A’s primary 
computer servers were located in Hudson County, New Jersey. 

c. Company B was a domain registrar and web hosting company 


headquartered in Scottsdale, Arizona. 







Overview 


2. From at least October 2013, and continuing through at least May 
2018, IVANOV and his co-conspirators devised and executed an international 
computer hacking scheme whereby they: 

a. Created and used fictitious entities, as well as fraudulent or 
stolen online identities, to purchase online advertising space; 

b. Used these entities and identities to register Internet domains 
that hosted malicious advertisements; and 

c. Launched malicious online advertising campaigns—so-called 
“malvertising”— in an effort to deceive victim Internet users and to deliver 
malicious software (“malware”) to the computers of users who viewed or 
accessed the malicious advertisement. 

3. IVANOV and his co-conspirators, through the above, caused 
unsuspecting Internet users to view or access their malicious advertisements 
on more than one hundred million occasions. By launching these malicious 
advertisement campaigns, IVANOV and his co-conspirators attempted to cause 
millions of dollars of losses to victim Internet users. 

4. IVANOV and his co-conspirators deployed a number of approaches 
to profit from the dissemination of malware and malicious advertisements. 

Relevant Terms and Definitions 

5. The Internet advertising industry has three main components: 
“online publishers,” “online advertising server platforms,” and “online 
advertising companies.” “Online publishers” are the organizations that operate 
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and rent out space on third-party websites, such as news, entertainment, or 
sports websites. “Online advertising companies” are organizations that work 
directly with companies and individuals to publish their online advertisements 
on the Internet. In addition, certain companies operate “online advertising 
server platforms” that use computer algorithms to facilitate the placement of 
advertisements submitted by “online advertising companies” with “online 
publishers.” 

6. “Display advertising” is a type of Internet advertising that uses web 
banners, frame ads, and other graphical advertisements that are delivered 
through websites that are accessed by computer users. Display advertising 
allows advertisers to track how many times an advertisement is viewed. 

7. “Impressions” refers to how many views an online advertisement 
receives. A view is counted when a computer browser visits a website and a 
particular advertisement is served to the browser. 

8. “Traffic” is used to generically describe visitors to a website or 
impressions of an advertisement. 

9. Malicious software (“malware”) is a software program designed to 
disrupt the operation of a computer or other device, gather sensitive 
information, gain access to the computer or other device, and take other 
unwanted actions. 

10. “Malicious advertisements” or “malvertisements” are online 
advertisements that attempt to direct the Internet browser of a victim computer 
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towards unwanted advertisements, malicious computer programs, or to other 
computers that can be used to install malware on the victim computer. 

11. A “domain name” is a simple, easy-to-remember way to identify, 
among other things, computers, servers, and networks, using a series of 
characters (e.g., letters, numbers, or other characters) that correspond with a 
particular Internet Protocol (“IP”) address. 

12. Domain names may be purchased through a “registrar,” which acts 
as the intermediary between the registry and the purchaser of the domain 
name. The individual or business that purchases, or registers, a domain name 
is called a “registrant.” 

The Conspiracy 

13. From at least in or around October 2013 through in or around May 
2018, in Hudson County, in the District of New Jersey, and elsewhere, the 
defendant, 

OLEKSII IVANOV, 
a/k/a “Oleksii Petrovich Ivanov,” 
a/k/a “Alex Ivanov,” 
a/k/a/“lBaHOB OAeKcin,” 

did knowingly and intentionally conspire and agree with others to devise a 
scheme and artifice to defraud and to obtain money and property by means of 
materially false and fraudulent pretenses, representations, and promises, and, 
for purposes of executing and attempting to execute such scheme and artifice 
to defraud, did transmit and cause to be transmitted by means of wire 
communications in interstate and foreign commerce certain writings, signs, 
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signals, pictures, and sounds, contrary to Title 18, United States Code, Section 


1343. 

Object of the Conspiracy 

14. The object of the conspiracy was for IVANOV and others to 
unlawfully enrich themselves by launching malicious advertisements. 

Manner and Means of the Conspiracy 

15. It was part of the conspiracy that: 

a. IVANOV and others created online personas and fictitious 
entities in order to pose as legitimate advertisers to advertising companies and 
advertising server platforms in correspondence or transactions regarding online 
advertising campaigns. 

b. IVANOV and others used fictitious and fraudulent aliases to 
register domains to be used in furtherance of publishing malicious 
advertisements, including domains registered with Company B. 

c. IVANOV and others deceived advertising companies and 
advertising server platforms, such as Company A, into causing the websites of 
third-party victim companies to publish malicious advertisements that 
appeared legitimate, but actually attempted to deliver malware to millions of 
victim Internet users. 

d. After online advertisers and advertising server platforms flagged 
the co-conspirators’ advertisements as malicious, IVANOV and others provided 
false and misleading statements designed to deceive advertisers and 
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advertising server platforms into continuing to cause the publishing of 
malicious advertisements. 

e. IVANOV and others repeatedly changed the personas and 
fictitious companies that they used to launch malicious advertisements to 
circumvent advertising companies’ and advertising server platforms’ anti- 
malvertising safeguards. 

f. IVANOV and others took steps to refine their malicious 
advertisements to circumvent advertising companies’ and advertising server 
platforms’ anti-malvertising safeguards, including using services that test 
malware and, using fictitious entities, corresponding with online advertising 
companies and other entities to learn why advertising server platforms had 
banned their advertisements as malicious. 

g. IVANOV and others attempted to enrich themselves by offering 
to sell access to networks of devices infected with malware. 

All in violation of Title 18, United States Code, Section 1349. 
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COUNTS TWO THROUGH FIVE 
(Wire Fraud) 


1. Paragraphs 1 through 12 and 14 through 15 of Count One of this 
Indictment are re-alleged and incorporated herein as though fully set forth in 
this Paragraph. 

2. From at least in or around October 2013 through in or around May 
2018, in Hudson County, in the District of New Jersey, and elsewhere, the 
defendant, 


OLEKSII IVANOV, 
a/k/a “Oleksii Petrovich Ivanov,” 
a/k/a “Alex Ivanov,” 
a/k/a/“lBaHOB OAeKciii,” 

did knowingly and intentionally devise a scheme and artifice to defraud and to 
obtain money and property by means of materially false and fraudulent 
pretenses, representations, and promises, and, for purposes of executing and 
attempting to execute such scheme and artifice to defraud, did transmit and 
cause to be transmitted by means of wire communications in interstate and 
foreign commerce certain writings, signs, signals, pictures, and sounds, each 
constituting a separate count of the Indictment: 


Count 

Approximate 

Date 

Wire Transmission 

2 

4/24/2014 

IVANOV caused a malicious advertisement hosted at 
an Internet domain address (“Domain 1”) to be 
electronically transmitted to the servers of Company 

A in the District of New Jersey for online publishing. 

3 

6/25/2014 

IVANOV caused a malicious advertisement hosted at 
an Internet domain address (“Domain 2”) to be 
electronically transmitted to the servers of Company 

A in the District of New Jersey for online publishing. 
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4 

7/3/2014 

IVANOV caused a malicious advertisement hosted at 
an Internet domain address (“Domain 3”) to be 
electronically transmitted to the servers of Company 

A in the District of New Jersey for online publishing. 

5 

7/15/2014 

IVANOV caused a malicious advertisement hosted at 
an Internet domain address (“Domain 4”) to be 
electronically transmitted to the servers of Company 

A in the District of New Jersey for online publishing. 


In violation of Title 18, United States Code, Section 1343 and Section 2. 
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COUNT SIX 

(Intentional Damage to a Protected Computer) 

1. Paragraphs 1 through 12 and 14 through 15 of Count One of this 
Indictment are re-alleged and incorporated herein as though fully set forth in 
this Paragraph. 

2. From on or about September 24, 2014, and continuing until the 
present, in Sussex County, in the District of New Jersey and elsewhere, the 
defendant, 

OLEKSII IVANOV, 
a/k/a “Oleksii Petrovich Ivanov,” 
a/k/a “Alex Ivanov,” 
a/k/a/“lBaHOB OAeKcift,” 

did knowingly cause the transmission of a program, information, code, and 
command, and aid and abet in the same, and as a result of such conduct, 
intentionally cause damage without authorization, to protected computers in 
the District of New Jersey and elsewhere, and the offense caused: (i) loss to one 
or more persons during any one-year period from IVANOV’s course of conduct 
affecting protected computers aggregating to at least $5,000 in value, and (ii) 
damage affecting ten or more protected computers during any one-year period. 

In violation of Title 18, United States Code, Sections 1030(a)(5)(A), 

(c)(4)(B) and Section 2. 
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FORFEITURE ALLEGATION AS TO COUNTS ONE THROUGH FIVE 


1. As a result of committing the offenses charged in Counts One 

through Five of this Indictment, the defendant, 

OLEKSII IVANOV, 
a/k/a “Oleksii Petrovich Ivanov,” 
a/k/a “Alex Ivanov,” 
a/k/a/“lBaHOB OAeKciii,” 

shall forfeit to the United States, pursuant to Title 18, United States Code, 
Section 981(a)(1)(C) and Title 28, United States Code, Section 2461, all 
property, real and personal, that constitutes or is derived from proceeds 
traceable to the commission of the said offense, and all property traceable 
thereto. 
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FORFEITURE ALLEGATION AS TO COUNT SIX 


1. As a result of committing the offense charged in Count Six of this 
Indictment, the defendant, 

OLEKSII IVANOV, 
a/k/a “Oleksii Petrovich Ivanov,” 
a/k/a “Alex Ivanov,” 
a/k/a/“lBaHOB OAeKcifi,” 

shall forfeit to the United States (a) pursuant to Title 18, United States Code, 
Sections 982(a)(2)(B) and 1030(i), any property, real or personal, constituting, 
or derived from, proceeds obtained directly or indirectly as a result of the 
offense charged in Count Six of this Indictment; and (b) pursuant to Title 18, 
United States Code, Section 1030(i), all right, title, and interest of the 
defendant in any personal property that was used or intended to be used to 
commit or to facilitate the commission of the offense charged in Count Six of 
this Indictment. 


11 



SUBSTITUTE ASSETS PROVISION 
(Applicable to All Forfeiture Allegations) 


1. If any of the above-described forfeitable property, as a result of any 
act or omission of the defendant: 


a. cannot be located upon the exercise of due diligence; 

b. has been transferred or sold to, or deposited with a third party; 

c. has been placed beyond the jurisdiction of the court; 

d. has been substantially diminished in value; or 

e. has been commingled with other property which cannot be divided 


without difficulty; 

the United States shall be entitled, pursuant to 21 U.S.C. § 853(p) (as 
incorporated by 28 U.S.C. § 2461(c) and 18 U.S.C. §§ 982(b) and 1030(i)), to 
forfeiture of any other property of the defendant up to the value of the above- 
described forfeitable property. 


A TRUE BILL 



FOREPERSON 




United States Attorney 


S^SJonfHolrmyolfice. 
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